Extracted

Extracted

• • Target

    ef3b97f9f413597b79c619a8c38ea4f3ca0ace8b508e1b252d551b32b981e4bb

  • Size

    660KB

  • MD5

    18f1cd84b75851051552d6236d8facda

  • SHA1

    140e59f4f46b7a4d28ca96b51b9206567c91ceb6

  • SHA256

    ef3b97f9f413597b79c619a8c38ea4f3ca0ace8b508e1b252d551b32b981e4bb

  • SHA512

    84d51080d40902a9400868eb8dc9271d21b91bb2a7004dcaf9289b939a4de41f8d923c9eb90b927c24cd9f98f3d408359c741f65b61b386ee84acd554586f427

  • SSDEEP

    12288:PMr+y90k+qZ+QcDUFZpFIiUo7+oPHbSPPeZShuYj1l6AsSK:9yxZLQ0FIi+JhuEsTb

  Score

  10^/10

  redlinerosnsporadiscoveryevasioninfostealerpersistencespywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline

  • RedLine payload

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1